Posted
by
samzenpus
on Monday July 07, 2014 @05:33PM
from the let's-see-what-you-typed-there dept.

mpicpp writes with a story about researchers who have developed a way to steal passwords using video-capturing devices.Cyber forensics experts at the University of Massachusetts in Lowell have developed a way to steal passwords entered on a smartphone or tablet using video from Google's face-mounted gadget and other video-capturing devices. The thief can be nearly ten feet away and doesn't even need to be able to read the screen — meaning glare is not an antidote. The security researchers created software that maps the shadows from fingertips typing on a tablet or smartphone. Their algorithm then converts those touch points into the actual keys they were touching, enabling the researchers to crack the passcode. They tested the algorithm on passwords entered on an Apple iPad, Google's Nexus 7 tablet, and an iPhone 5.

Better make it "No Cameras Allowed". Which, incidentally, also means "No Smartphones or Tablets Allowed", since they all have cameras... which would actually eliminate the risk of passwords being stolen as they're entered into a smartphone or tablet, since no smartphones or tablets are allowed. Problem solved!

Better make it "No Cameras Allowed". Which, incidentally, also means "No Smartphones or Tablets Allowed", since they all have cameras... which would actually eliminate the risk of passwords being stolen as they're entered into a smartphone or tablet, since no smartphones or tablets are allowed. Problem solved!

Shut up, glasshole.

Jealous, much? Actually, I don't have Google Glass... but I'm hoping to get one for Christmas this year. Neener neener!

Of course if you are entering a password whilst using an augmented reality device only you can see what you are doing and why you are doing it. So only way to defeat all those countless surveillance cameras http://www.telegraph.co.uk/tec... [telegraph.co.uk] , http://www.nbcnews.com/id/4416... [nbcnews.com]. Perhaps google glass isn't the problem perhaps the problem already exists.

This has nothing to do with google glass, other than a headline whore trying to hype his article.Any video capture device, like every smartphone, security camera, and other form of video camera on the planet can be used for this.

The fact that the device is out in the open when the password is entered is the problem here.

There's one technology that solves this problem, and that technology is genital recognition. It works like a password, but it depends on the unique pattern exhibited by each individual's genitalia.

When a password needs to be entered, the user puts the phone down his or her pants/skirt/dress/whatever, and presses the screen against his or her genitalia. The pattern is then analyzed and compared against known data poi

I'm churning this over in my head to see if it sparks an idea that might actually be practical. My last major security-related software project was based on gender recognition, so this isn't too far off.
Regarding my last project - captchas suck. People aren't much better than computers at recognizing squiggly letters. We are, however, REALLY good at spotting hot chicks.

not always just in highly secure facilities.In France the bank associated to the national post office -one you wouldn't expect recruiting geniuses- does present such a variable keypad when you want to access your account, and even more: you must move the mouse over each digit without clicking, basically following a path (a bit like on some phone unlock interfaces) but one that is different each time...

Being able to customize the keyboard based on the current input required is one of the best feature of virtual keyboards. I thought everyone would be randomizing the keyboard for the "password" field by now.

I thought everyone would be randomizing the keyboard for the "password" field by now.

You thought everyone would want to be reduced to the level of "hunt and peck" they were at the very first the time they saw a keyboard EVERY single time they needed to enter a password?

And what does it get you as a defense vs "google glass attack"? Well, not only do they have to see you enter the password from some oblique angle but for one instant during entry or before they need to see your 'one time virtual keyboard' or

But they are a pain to use, since most of us do password entry with some muscle memory, and on a smart phone nobody which one opens and unlocks 100 times a day nobody is going to want to have to exert that much effort.

That's horrible use case. It really should not matter if the hacker can get your used one time token after you have entered it. Of course, it's bigger deal if they are not actually one time tokens like in Wildstar (you can use the token until it expires), but that should be fixed by making them one time tokens.

electronic keypads should randomize the numeric order and that the device should not mirror the letter typed on the inout line or on the keypad.

OR... you could just walk around as you type throwing off their algorithm and not introduce another overly complicated and insanely annoying security feature that would simply push people into not securing their devices at all.

electronic keypads should randomize the numeric order and that the device should not mirror the letter typed on the inout line or on the keypad.

I used to work at a secure facility with a keypad like this. It was the first stage to getting into the building. You would hit a button and the digits would randomize. I eventually got to the point where I could look at the pad and input my 6 digit code within about 2 seconds. It took me about 2-3 weeks to get that down pat. After that, I would only mess up about once or twice a month.

I can only agree when you have a keypad that only has one code (one user), and you use it daily. Otherwise the used keys get worn out, which can help possible intruders. For a 4 digit PIN you will have 4!=24 possibilities instead of 10^4=10000, and even less when one digit occurs twice.

I suppose you can be more subtle about it, but really any video cam would work just as well. Especially if you set it up near a place where people will be typing a useful password instead of loitering and staring at people.

Try taking a handheld camera and hold it at people who are typing their phone or ATM pincode and see what happens... (Warning damage yo your face may occur). The problem is that you can't pretend it is off like you can with a google glass.

Step 1: Put on a dress shirt (or any shirt with a pocket on the front).Step 2: Start your camera video recording and put it on your pocket (camera facing out, of course).Step 3: Wait in line behind the person and position yourself so that you have a good view but also so that it's not obvious what you are doing. Pretend to be looking at something else. (Look at your watch or a book or something.)Step 4: Review the footage later and get the person's password or PIN.

So, what? You approach well endowed women of the appropriate height, say "Excuse me for a second", and place your phone on their voluminous cleavage, freeing both hands for securely entering your password?

As the video points out, this is not limited to Google Glass, any video capturing device will work. But beyond that, this is really kind of obvious. Yeah, video recording someone entering their password on a touch device will give you a fairly accurate idea of what that password is. Record, playback at 1/4 speed, password. I would bet that security camera footage might even be better to work with due to the angle. The custom software I suppose is a nice achievement, but I would guess it's not all that necessary.

As the video points out, this is not limited to Google Glass, any video capturing device will work. But beyond that, this is really kind of obvious. Yeah, video recording someone entering their password on a touch device will give you a fairly accurate idea of what that password is. Record, playback at 1/4 speed, password. I would bet that security camera footage might even be better to work with due to the angle. The custom software I suppose is a nice achievement, but I would guess it's not all that neces

Seems rather the opposite. We're very good at noticing when someone is looking at us (a leftover from being prey I suspect), but I always see people standing, holding their phone angled slightly (pointed nicely at any laptops at nearby tables). Add a fake game screen while the camera runs for extra stealth.

Except with Glass it's easier to do it by casually looking in the direction of the person. I'm fairly certain if someone has their smartphone or camcorder pointed in your direction steadily it's a little more obvious than someone just looking past you who happens to be wearing Glass.

Except with every other inexpensive video only device on market, and especially those designed for the task, it is even easier and more stealthy than Glass.Ex. http://www.newegg.com/Camcorde... [newegg.com] Those start around $10.For $45 you can get a pair of sunglasses that look very much like average sunglasses and have a 720p video recorder. http://www.newegg.com/Product/... [newegg.com]... and I'm sure all those and more can be found cheaper elsewhere.

This is not a Google Glass hack in any way, shape, or form. It would not surpr

Why doesn't someone just modify the snippet of code in the OS that displays the touch keys on the phone/tablet screen to place them in a new random order each time you unlock the device so that when you enter the PIN to unlock the device you never use the same finger placement pattern twice? That would also prevent analysis of scratches/smudges on the surface of the device as a means of cracking it.